Collaborate Disseminate
If a website user wants to use WebAuthn, they will start by creating a credential, where their authentication device provides a public key.
This key is encoded, and sent back to the server to store against their account.
Later, when the … Continue reading Risks with OpenSSL verifying a signature with un-trusted PEM encoded public key
OpenSK is a piece of firmware that you can install on a USB dongle of your own, turning it into a usable FIDO or U2F key. Continue reading Google launches open-source security key project, OpenSK
As I read through the WebAuthn / FIDO2 documentation, it appears the authentication is done on the local device to create an attestation to the FIDO server. This future implies the “biometrics” or other Authenticator means m… Continue reading WebAuthn Variation with non-connect dongle Authenticator
Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, …).
Given the case that a… Continue reading How to add a new webauthn key if the existing one isn’t portable
When registering a new credential as part of WebAuthn, why does the client need to be sent a challenge?
Presumably this is to prevent a replay attack, but wouldn’t a replay attack be prevented by TLS already?
I’ve been reading both FIDO and FIDO2 specs for a while tring to understand the similarities and differences between both. Here is how I broke it down so far:
FIDO: First iteration in creating a cross industry standard for passwordless … Continue reading FIDO and FIDO2 differences
Some types of 2FA security can no longer be guaranteed to keep the bad guys out, the FBI warned US companies. Continue reading Hackers bypassing some types of 2FA security FBI warns
My ideal bank would offer online banking from a browser with user/pwd and WebAuthn, for example with a NFC or USB key. No OTP or SMS or apps on the smartphone or physical devices required. (It goes without saying, no recovery… Continue reading Why don’t online banks use WebAuthn? [on hold]
Is there a way to emulate Webauthn so that we’ll be able to a automated testing on our FIDO2 server?
I have a yubikey which supports only U2F. It doesn’t support FIDO2. I read about U2F and i understand how it works.
When i test my Yubikey for WebAuthn on https://webauthn.io it works. I wanted to know how WebAuthn works wi… Continue reading Yubikey – WebAuthn and U2F